Security is not a feature you add later — it is a discipline you practice from the first line of code. This checklist covers the security patterns every WordPress developer should follow.
Output Escaping
Every piece of data displayed to the user must be escaped. Use esc_html() for HTML context, esc_attr() for attributes, esc_url() for URLs, and wp_kses_post() for rich content. There are no exceptions.
Input Sanitization
Never trust user input. Use sanitize_text_field() for plain text, absint() for numbers, sanitize_email() for emails, and wp_unslash() before sanitizing superglobals.
Nonce Verification
Every form submission and AJAX request must include a nonce. Generate with wp_nonce_field() or wp_create_nonce(). Verify with check_admin_referer() or check_ajax_referer().
Capability Checks
Before performing any privileged action, verify the user has the required capability with current_user_can(). Never assume a logged-in user is an admin.
Database Safety
Use $wpdb->prepare() for any query with user-supplied values. Never concatenate variables into SQL strings. Prefer the WP_Query API over direct database queries.
File Security
Start every PHP file with if ( ! defined( 'ABSPATH' ) ) { exit; } to prevent direct access. Never expose WordPress internals through debug output in production.
